Welcome to the Deep Dive.
Today, we're really ripping the lid off
the latest intelligence, specifically the Byer-
Nichols Threat Brief for the back half of October, 2025.
Look, this isn't just about recapping headlines.
We want to understand how the whole game has fundamentally
shifted just in the last month or so, or mission.
Simple.
We need to quickly boil down the key changes you absolutely
need to grasp.
We're talking everything from, you know, huge critical
infrastructure exposure, all the way to brand new tactics
where attackers are actually using public blockchains
to stay operational.
And honestly, if you haven't seen the robbery yet,
the initial numbers are, well, they're pretty staggering,
just the sheer scale of immediate exposure.
The summary kicks off with a really severe incident
involving F5, SARS-CoV-DET stolen, right?
And that seems to have directly led to over 266,000 F5 BIGIP
instances being exposed, basically vulnerable to remote attacks.
OK, I have to jump in there.
266,000.
Publicly reachable devices.
I mean, that's practically a national security issue
right there, isn't it?
Regardless of who's attacking, that number alone
should be a massive red flag for everyone.
Oh, absolutely.
It should be.
And the report makes a critical point,
one that applies to every single organization big or small.
The core failure here isn't just the source code theft
as bad as that is.
It's the fact that management interfaces
for your network gear, your firewalls,
load balancers, all that stuff.
They should never, ever be just hanging out there
on the public internet.
This whole incident just confirms
that sloppy network setup is the starting point
for these huge failures.
So right off the bat, we're talking
about these massive foundational vulnerabilities.
Like the basement door is wide open.
Exactly.
And look, the F5 thing, it's not alone.
The brief also flags a critical RCE that's
remote code execution vulnerability.
It's affecting over 75,000 watch guard security devices.
And just a quick reminder, RCE basically
means an attacker can run their own malicious code
on your device from anywhere without needing permission.
So the environment we're looking at here,
it's exposed, it's vulnerable, and you
can bet the attackers are noticing.
OK, that really sets the stage.
We've got the vulnerability, the exposed infrastructure.
Now let's talk about how the big criminal players
are actually catching in on this.
Yeah.
Because the ransomware charts, they show a pretty shocking
strategic turn.
I mean, yeah, Quillen is still way out in front, victim-wise.
But the real story isn't the leader.
It's the sudden, dramatic, frankly terrifying comeback
of a group we thought had mostly disappeared.
Right, we're talking about CL0P.
This group, they'd posted almost zero victims
since what may, July, basically, quiet all summer,
then almost overnight.
Boom, a massive reentry.
They hit 18 victims in about three weeks.
That's just a stunning acceleration.
Put them right back in the top tier of active groups, just
like that.
Wow.
OK, so what's driving that?
I mean, they always had the name recognition,
but you don't just jump back into the top five like that
without some kind of major change in how you operate.
That change is absolutely key.
And it links right back to what you
said about exposed infrastructure.
CL0P is leaning hard into what the report calls
encryption-less ransomware.
Think of it like pure data extortion.
They don't even bother encrypting your files anymore.
Why skip the encryption?
Isn't that the whole point?
Well, it used to be.
But the reports suggest more companies
have gotten pretty good with backups and recovery.
So traditional crypto ransomware.
Maybe less profitable now.
OK, so even if I have perfect backups,
I can get my data back, sure.
But CL0P gets around that by just stealing the info
and threatening to leak it or sell it.
So the whole threat model shifts.
It's less about recovery time and more about total reputational
meltdown or regulatory fines.
Precisely.
And this pure focus, it's incredibly effective.
Remember CL0P is thought to have
extorted what, over half a billion dollars historically?
They clearly see this high-impact reputational threat
as the most reliable money maker right now.
OK, let's break down who's really feeling the pain
from this pure extortion model.
Looking at the sectors, manufacturing and financial services
are almost tied for the top targets.
But the data on company size--
that's what really jumps at.
It's critical for our listeners to hear this.
It really is, yeah.
When you look at victim size, the overwhelming majority
we're talking almost four out of five, something like 77%
are small businesses.
Organizations with 500 employees or fewer.
They are the main targets for these incredibly sophisticated
multi-million dollar extortion gangs.
OK, I get the mechanics.
But if CL0P is hitting 77% small businesses,
how is a smaller company even supposed
to deal with that kind of reputational risk?
They don't have massive PR teams or huge legal departments
to handle a public data leak.
The cost of this pure extortion threat
feels disproportionately high for them.
Right.
That's the really tough reality the brief points to.
It forces you to completely rethink your defenses.
And geographically, while the US is still number one,
over half the victims, there was a pretty big shift
in the global top five list this time.
That's really a pop top.
Right.
That's true.
Yeah, exactly.
Australia joined the top five victim locations
in this reporting period.
That really suggests some successful targeted campaigns
hitting the Egypt Pacific region.
It proves that while, yeah, US targets are still profitable,
these groups are actively aggressively
looking elsewhere too, diversifying.
Okay, so if they're adapting how they make money,
like CL0P's pure extortion,
how are the other players adapting?
I mean, the state sponsored groups,
they're really sophisticated financial actors.
How are they changing their own infrastructure?
Let's shift to these cutting edge tactics.
The new adversaries and their whole quest for resilience.
Right.
Resilience and speed.
They're investing heavily in both.
Take star blizzard, also known as coal driver,
that's a perfect example of speed.
This is believed to be a Russian intelligence
linked group focused on espionage.
They do a lot of spearfishing against Western think tanks,
defense contractors, that sort of thing.
And their whole story is just relentless adaptation,
isn't it?
Keep moving.
Keep changing.
Exactly.
Earlier this year, researchers exposed their main tool,
malware called Lost Keys.
What do they do?
They didn't just tweak it.
They switched gears incredibly fast.
Rolled out completely new malware families,
nor robot, yes robot, neighbor robot, Google's analysis,
which is cited in the brief confirms it.
Coal driver is developing and deploying malware faster,
more aggressively than ever.
Speed itself has become their main defense
against getting caught.
That rapid development cycle is scary enough.
But what seems truly, I don't know, groundbreaking.
And maybe a bit shocking, is how the financially motivated
groups are using decentralized tech.
Tell us about this group, UNC5142,
and its innovative use of the blockchain.
OK, so UNC5142 is financially driven, right?
And they've figured out something pretty fundamental.
The easiest way to stop someone from taking down your operation
is to put your command structure somewhere
that can't be taken down.
So they're abusing public blockchain technology
to get maximum resilience.
Let's break that down for listeners.
Why is that so effective?
Normally, if, say, the FBI finds a command and control
server, the C2, they get a core order.
ISP takes it down, lights out for the malware, right?
That's the traditional way, yeah, the kill switch.
But think about it.
What if the instructions for the malware,
or maybe even the next piece of code it needs to download?
What if that lives on an immutable ledger, something
like a public blockchain salana, maybe Ethereum?
There's no single server to seize.
The data is spread out globally, and crucially,
it can't be changed.
It becomes effectively impossible for law enforcement
or security companies to just switch it off.
Wow.
That really is maximum resilience built right in.
And the malware they use for this.
That's Rad Theif, also known as Radimethis.
It's an info stealer.
And it's specifically using smart contracts on the blockchain
to distribute its later stages.
It means the malware's critical communication channel
is basically outside the reach of normal security tools
and governance.
All right, let's pivot now.
We need to talk about the Amiti critical threats,
the stuff that needs patching yesterday,
and also some of these genuinely next-level malware
families that are popping up.
Absolutely.
We have to highlight the extreme urgency
around a really stunning vulnerability in Microsoft's Windows
Server update service, WSUS.
This was so bad, Microsoft pushed out
an emergency out of Band Update, which they really
don't do lightly.
Why the panic?
What made this one so critical?
Access.
It's all about the access it gave.
This vulnerability allowed an unauthenticated actor,
meaning someone without a password, not logged in,
to achieve remote code execution with system privileges.
That's it.
Game over.
Full control of the server.
An attacker could just run code with the highest possible
authority.
If you were running affected versions,
the only move was to patch immediately.
No excuses.
And it wasn't just Microsoft, right?
The brief mention, a whole slew of vendors
with actively exploited vulnerabilities.
It's a broad problem.
That's right.
The list of CVEs being actively hit wasn't
limited to Microsoft at all.
We saw critical flaws under attack in Apple products,
Broadcom VMware, and even major e-commerce platforms,
like Adobe Commerce, which you might know as Magento,
and AEM forms, and they just confirms defenders
are basically fighting a war on too many fronts at once.
OK, the brief also had some really fascinating details
on new malware families.
Stuff that highlights just how technically sophisticated
these actors are getting.
They seem really focused on Next Gen Stealth
and that resilience theme we keep hitting.
Yeah, let's start with ClearShot.
This is a multi-stage loader.
And it's used by that same blockchain group, UNC 5142.
They target a vulnerable WordPress site,
super-commonentary point right, and use them
to host the first stage of ClearShot.
But then, and this is the clever part,
the malware loads at second stage directly
from the public blockchain.
Whoa.
OK, so they use an old, easy vulnerability WordPress
to deliver this super-modern, highly resilient payload.
That's disturbingly efficient.
It is.
And then to actually infect the user's machine, the endpoint,
they use a social engineering trick called ClickFix.
Basically, they con the victim into clicking a link,
maybe pretending it's to fix some issue.
And that click gives the initial foothold
for the blockchain-based payload to deploy.
That's terrifyingly clever.
Yeah.
But maybe not as mind-bending as the evasion used by Glassworm.
This one sounded almost like science fiction.
Glassworm is, yeah, it's genuinely revolutionary
and how it hides.
It's the first worm we've seen spreading
through VS Code extensions in the Open VSX marketplace.
So it targets developers directly.
But the real innovation, how it evades
detection, it hides malicious code using invisible character.
Invisible characters.
You mean like hidden messages in the code itself?
Stagnography for source code?
Yeah, exactly like that.
It uses specific unicode characters
that look completely identical to a human looking at the code.
Even basic security tools might miss them.
But these characters change how the code actually runs.
It defeats both the human eye and simple scanners.
The malicious part hides in plain sight
inside what looks like totally legitimate code.
And guess what?
Tying back to resilience.
It controls the machines.
It infects through the Salana blockchain for its C2 network.
Wait, hold on.
So they're exploiting how we read code,
the limitations of human perception,
not just how computers execute it.
That's next level operational security for the bad guys.
It really is.
It forces a complete rethink of how you even review code.
And finally, the brief touched on an issue
with a macos threat.
Something that raises specific concerns
about Apple's own built-in security.
That would be Odyssey Steelers, a macos infosterior.
Now, the malware itself isn't necessarily groundbreaking,
but how it's being deployed.
That's the worry.
Samples of Odyssey have been found out
in the wild code sign with a valid Apple developer ID.
Which means what exactly?
For the average user.
It's like having a fake ID that looks absolutely perfect.
When software is signed with a valid Apple developer ID
and notarized by Apple, it basically
tells macos is built in security, gatekeeper.
Hey, this is legit.
I'm vouched for.
So it bypasses those standard checks.
It allows the malware to be downloaded
and run without being blocked or even flagged as suspicious.
It shows attackers are going to extreme lengths
like stealing valid developer keys just
to get past platform security.
OK.
So let's try to pull all these threads together.
We've talked about Star Blizzard Speed, UNC5142 using
blockchain, CL-ZeroP, ditching encryption
for pure extortion, those thousands
have exposed F5 devices.
What's the bottom line here?
What connects all this?
I think the overarching trend is pretty clear.
Adversaries are aggressively prioritizing really three things.
Resilience, speed, and high impact extortion.
Resilience-- so they can't be taken down easily.
That's the blockchain C2 stuff-- speed.
So they can iterate faster than defenders can keep up.
That's cold driver.
And high impact extortion, the pure data theft model
confirms that the main threat for you, the listener,
is shifting.
It's moving away from just internal recovery
headaches towards external risk, public exposure,
regulatory fines, brand damage.
That's the new battleground.
And just to add context, we should quickly mention some
of the wider news items that brief included,
there was that huge, prosper data breach, 17.6 million accounts,
just underscores the sheer volume of data at risk.
Right.
And then you see the consequences, like
experience getting fined $3.2 million
for mass collecting personal data.
That reinforces the regulatory pressure
that actually makes data theft so valuable for extortionists.
Also that pin to own Ireland event.
Wow.
Hackers found 34 is zero days on day one, 56 on day two.
That's just a stark reminder of how much undiscovered attack
services still out there, even in popular software.
And let's not forget, the basics still work.
The brief mentioned LinkedIn phishing, targeting finance
execs with fake board meeting invites,
still trying to get that initial foothold
through simple deception.
So this deep dive into the buyer nickel's brief.
It paints a picture, doesn't it?
It's unequivocally clear.
We're going to rapidly accelerating technically
sophisticated threat environment.
The infrastructure is exposed.
And the adversaries are well funded, agile,
and frankly quite innovative.
Which really brings us to a final provocative thought
for you to chew on.
Given this definitive shift by major groups
like CL0P towards encryptionless ransomware,
focusing purely on data extortion,
and knowing that almost 80% of their victims
are small and mid-market companies,
the question becomes, what's the real cost of cyber defense
today?
If the number one threat is public exposure
and brand destruction, not just system downtime,
should your defensive strategy now
focus just as much on things like rigorous data separation,
internal risk management, having
a solid crisis communication plan ready to go?
Is that just as important now as having good backups?
Because maybe the target isn't really your systems anymore.
Maybe it's your reputation.
That is a critical question and one that demands
immediate attention.
Thank you for joining us for this deep dive.
Reach out to us at jbuyer.com for comments and questions.
Follow us at buyer company on social media.
And if you'd be so kind, please rate and review us
in your podcast app.
[Music]